From 5badc0e38aa118aba530500741fffc81e0237cd7 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Sun, 2 Aug 2026 17:33:12 -0700
Subject: [PATCH] Simplify secret verification and ensure byte lengths are
 equal.

---
 src/lib/vault/vault-worker.ts | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index e056f29..57c73b8 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -363,25 +363,14 @@ function verify (seed?: ArrayBuffer, mnemonicPhrase?: string): Promise<Record<st
 		if (seed != null && mnemonicPhrase != null) {
 			throw new Error('Seed or mnemonic phrase must be verified separately')
 		}
+		const expected = seed != null ? new Uint8Array(seed) : utf8.toBytes(mnemonicPhrase ?? '')
+		const actual = seed != null ? new Uint8Array(_seed) : new Uint8Array(_mnemonic ?? [])
 		let isVerified = false
-		if (seed != null) {
-			let diff = 0
-			const userSeed = new Uint8Array(seed)
-			const thisSeed = new Uint8Array(_seed)
-			for (let i = 0; i < userSeed.byteLength; i++) {
-				diff |= userSeed[i] ^ thisSeed[i]
-			}
-			isVerified = diff === 0
-		}
-		if (mnemonicPhrase != null) {
-			let diff = 0
-			const userMnemonic = utf8.toBytes(mnemonicPhrase)
-			const thisMnemonic = new Uint8Array(_mnemonic ?? [])
-			for (let i = 0; i < userMnemonic.byteLength; i++) {
-				diff |= userMnemonic[i] ^ thisMnemonic[i]
-			}
-			isVerified = diff === 0
+		let diff = 0
+		for (let i = 0; i < expected.byteLength; i++) {
+			diff |= expected[i] ^ actual[i]
 		}
+		isVerified = diff === 0 && expected.byteLength === actual.byteLength
 		return Promise.resolve({ isVerified })
 	} catch (err) {
 		console.error(err)
-- 
2.52.0